Configure your Sysmon for Linux deployment to collect data

Sysmon events are stored in Linux journald

Prepare your Sysmon configuration file based on your security team or SOC needs. You can start from attack_range/config. This is verbose, so adjust the filtering rules of each event type according to your environment needs.

To learn more about configuration file preparation and adjustment, see:

• Microsoft documentation on Sysmon
• TrustedSec Sysmon Community Guide
• Olaf Hartong's sysmon-modular
• SwiftOnSecurity sysmon-config